curl "https://ipg.irandargah.com/v2/payments" \
  -H "Authorization: Bearer idg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx"

<?php
$headers = [
    'Authorization: Bearer idg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type: application/json',
];

const headers = {
  Authorization: "Bearer idg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx",
  "Content-Type": "application/json",
};

req.Header.Set("Authorization", "Bearer idg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx")
req.Header.Set("Content-Type", "application/json")

headers = {
    'Authorization': 'Bearer idg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx',
    'Content-Type':  'application/json',
}

client.DefaultRequestHeaders.Add("Authorization", "Bearer idg_live_xxxxxxxxxxxxxxxxxxxxxxxxxxxx");

https://sandbox.irandargah.com

# Production
BASE_URL="https://ipg.irandargah.com";       TOKEN="YOUR_PRODUCTION_TOKEN"
# یا Sandbox
BASE_URL="https://sandbox.irandargah.com";   TOKEN="YOUR_SANDBOX_TOKEN"

curl -X POST "$BASE_URL/v2/payments" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 100000,
    "order_id": "ORDER-12345",
    "callback_url": "https://yoursite.com/callback"
  }'

<?php
$environment = 'sandbox'; // 'production' یا 'sandbox'
$config = [
    'production' => [
        'base_url' => 'https://ipg.irandargah.com',
        'token'    => 'YOUR_PRODUCTION_TOKEN',
    ],
    'sandbox' => [
        'base_url' => 'https://sandbox.irandargah.com',
        'token'    => 'YOUR_SANDBOX_TOKEN',
    ],
];
$baseUrl = $config[$environment]['base_url'];
$token   = $config[$environment]['token'];

$paymentData = [
    'amount'       => 100000,
    'order_id'     => 'ORDER-' . time(),
    'callback_url' => 'https://yoursite.com/callback',
    'description'  => 'خرید تستی',
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "{$baseUrl}/v2/payments");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($paymentData, JSON_UNESCAPED_UNICODE));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);
if ($result['success']) {
    $gatewayUrl = $result['data']['transaction']['gateway_url'];
    header('Location: ' . $gatewayUrl);
}
?>

const environment = "sandbox"; // یا "production"
const config = {
  production: {
    base_url: "https://ipg.irandargah.com",
    token: "YOUR_PRODUCTION_TOKEN",
  },
  sandbox: {
    base_url: "https://sandbox.irandargah.com",
    token: "YOUR_SANDBOX_TOKEN",
  },
};
const { base_url, token } = config[environment];

const response = await fetch(`${base_url}/v2/payments`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    amount: 100000,
    order_id: `ORDER-${Date.now()}`,
    callback_url: "https://yoursite.com/callback",
    description: "خرید تستی",
  }),
});

const result = await response.json();
if (result.success) {
  window.location.href = result.data.transaction.gateway_url;
}

type EnvConfig struct{ BaseURL, Token string }

config := map[string]EnvConfig{
    "production": {"https://ipg.irandargah.com",     "YOUR_PRODUCTION_TOKEN"},
    "sandbox":    {"https://sandbox.irandargah.com", "YOUR_SANDBOX_TOKEN"},
}
env := config["sandbox"] // یا "production"

payload, _ := json.Marshal(map[string]interface{}{
    "amount":       100000,
    "order_id":     fmt.Sprintf("ORDER-%d", time.Now().Unix()),
    "callback_url": "https://yoursite.com/callback",
})

req, _ := http.NewRequest("POST", env.BaseURL + "/v2/payments", bytes.NewBuffer(payload))
req.Header.Set("Authorization", "Bearer " + env.Token)
req.Header.Set("Content-Type", "application/json")

client := &http.Client{}
resp, _ := client.Do(req)
defer resp.Body.Close()

import requests, time

config = {
    'production': {'base_url': 'https://ipg.irandargah.com',     'token': 'YOUR_PRODUCTION_TOKEN'},
    'sandbox':    {'base_url': 'https://sandbox.irandargah.com', 'token': 'YOUR_SANDBOX_TOKEN'},
}
env = config['sandbox']  # یا 'production'

response = requests.post(
    f"{env['base_url']}/v2/payments",
    headers={
        'Authorization': f"Bearer {env['token']}",
        'Content-Type':  'application/json',
    },
    json={
        'amount':       100000,
        'order_id':     f"ORDER-{int(time.time())}",
        'callback_url': 'https://yoursite.com/callback',
        'description':  'خرید تستی',
    }
)

result = response.json()
if result['success']:
    gateway_url = result['data']['transaction']['gateway_url']

var config = new Dictionary<string, (string BaseUrl, string Token)> {
    ["production"] = ("https://ipg.irandargah.com",     "YOUR_PRODUCTION_TOKEN"),
    ["sandbox"]    = ("https://sandbox.irandargah.com", "YOUR_SANDBOX_TOKEN"),
};
var env = config["sandbox"]; // یا "production"

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", $"Bearer {env.Token}");

var body = new {
    amount       = 100000,
    order_id     = $"ORDER-{DateTimeOffset.Now.ToUnixTimeSeconds()}",
    callback_url = "https://yoursite.com/callback",
    description  = "خرید تستی",
};
var content  = new StringContent(JsonConvert.SerializeObject(body), Encoding.UTF8, "application/json");
var response = await client.PostAsync($"{env.BaseUrl}/v2/payments", content);

BASE_URL="https://sandbox.irandargah.com"
TOKEN="YOUR_SANDBOX_TOKEN"

curl -X POST "$BASE_URL/v2/verifications" \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "authority": "2025100121424146HC",
    "amount": 100000
  }'

<?php
$baseUrl = 'https://sandbox.irandargah.com';
$token   = 'YOUR_SANDBOX_TOKEN';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "{$baseUrl}/v2/verifications");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer {$token}",
    "Content-Type: application/json",
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode([
    'authority' => '2025100121424146HC',
    'amount'    => 100000,
]));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const baseUrl = "https://sandbox.irandargah.com";
const token = "YOUR_SANDBOX_TOKEN";

const response = await fetch(`${baseUrl}/v2/verifications`, {
  method: "POST",
  headers: {
    Authorization: `Bearer ${token}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({
    authority: "2025100121424146HC",
    amount: 100000,
  }),
});

baseURL := "https://sandbox.irandargah.com"
token   := "YOUR_SANDBOX_TOKEN"

payload, _ := json.Marshal(map[string]interface{}{
    "authority": "2025100121424146HC",
    "amount":    100000,
})

req, _ := http.NewRequest("POST", baseURL + "/v2/verifications", bytes.NewBuffer(payload))
req.Header.Set("Authorization", "Bearer " + token)
req.Header.Set("Content-Type", "application/json")

client := &http.Client{}
resp, _ := client.Do(req)
defer resp.Body.Close()

base_url = 'https://sandbox.irandargah.com'
token    = 'YOUR_SANDBOX_TOKEN'

response = requests.post(
    f'{base_url}/v2/verifications',
    headers={
        'Authorization': f'Bearer {token}',
        'Content-Type':  'application/json',
    },
    json={
        'authority': '2025100121424146HC',
        'amount':    100000,
    }
)

var baseUrl = "https://sandbox.irandargah.com";
var token   = "YOUR_SANDBOX_TOKEN";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", $"Bearer {token}");

var body    = new { authority = "2025100121424146HC", amount = 100000 };
var content = new StringContent(JsonConvert.SerializeObject(body), Encoding.UTF8, "application/json");
var response = await client.PostAsync($"{baseUrl}/v2/verifications", content);

curl -X POST "https://sandbox.irandargah.com/v2/payments" \
  -H "Authorization: Bearer YOUR_SANDBOX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "amount": 100000,
    "order_id": "TEST-001",
    "callback_url": "https://yoursite.com/callback"
  }'

{
  "success": true,
  "data": {
    "transaction": {
      "authority": "20250107145623ABCDEF",
      "gateway_url": "https://sandbox.irandargah.com/startpay/20250107145623ABCDEF",
      "expires_at": "1404-10-17 15:11:23"
    },
    "meta": {
      "request_id": "sandbox_678abc123",
      "processing_time_ms": 45,
      "environment": "sandbox",
      "test_mode": true
    }
  },
  "message": "تراکنش با موفقیت ایجاد شد",
  "status_code": 100,
  "timestamp": "1404-10-17 14:56:23"
}

https://yoursite.com/callback?
  authority=2025100121424146HC&
  status_code=201&
  message=پرداخت+در+انتظار+تایید+است&
  amount=100000&
  order_id=TEST-001&
  ref_id=123456789&
  card_pan=603799******6789

curl -X POST "https://sandbox.irandargah.com/v2/verifications" \
  -H "Authorization: Bearer YOUR_SANDBOX_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "authority": "2025100121424146HC",
    "amount": 100000
  }'

curl -X GET "https://ipg.irandargah.com/v2/idempotency-key"

<?php
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/idempotency-key");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$response = curl_exec($ch);
curl_close($ch);
$result = json_decode($response, true);
$idempotencyKey = $result['idempotency_key'];
?>

fetch("https://ipg.irandargah.com/v2/idempotency-key")
  .then((response) => response.json())
  .then((data) => {
    const idempotencyKey = data.idempotency_key;
    console.log("Idempotency Key:", idempotencyKey);
  });

resp, err := http.Get("https://ipg.irandargah.com/v2/idempotency-key")
if err != nil {
    log.Fatal(err)
}
defer resp.Body.Close()

var result map[string]interface{}
json.NewDecoder(resp.Body).Decode(&result)
idempotencyKey := result["idempotency_key"].(string)

import requests

response = requests.get('https://ipg.irandargah.com/v2/idempotency-key')
data = response.json()
idempotency_key = data['idempotency_key']

using var client = new HttpClient();
var response = await client.GetAsync("https://ipg.irandargah.com/v2/idempotency-key");
var json = await response.Content.ReadAsStringAsync();
var result = JsonConvert.DeserializeObject<dynamic>(json);
string idempotencyKey = result.idempotency_key;

{
  "success": true,
  "idempotency_key": "txn_1a2b3c4d5e6f7g8h9i0j",
  "expires_in": 86400,
  "usage": "Include this key in the Idempotency-Key header for your payment request"
}

curl -X POST "https://ipg.irandargah.com/v2/payments" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: unique-key-123" \
  -d '{
    "amount": 100000,
    "order_id": "ORDER-12345",
    "callback_url": "https://merchant.com/callback",
    "description": "خرید محصول آزمایشی",
    "mobile": "09123456789"
  }'

<?php
$data = [
    'amount' => 100000,
    'order_id' => 'ORDER-12345',
    'callback_url' => 'https://merchant.com/callback',
    'description' => 'خرید محصول آزمایشی',
    'mobile' => '09123456789'
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/payments");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer YOUR_API_TOKEN",
    "Content-Type: application/json",
    "Idempotency-Key: unique-key-123"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
$httpCode = curl_getinfo($ch, CURLINFO_HTTP_CODE);
curl_close($ch);

$result = json_decode($response, true);
?>

const payment = {
  amount: 100000,
  order_id: "ORDER-12345",
  callback_url: "https://merchant.com/callback",
  description: "خرید محصول آزمایشی",
  mobile: "09123456789",
};

const response = await fetch("https://ipg.irandargah.com/v2/payments", {
  method: "POST",
  headers: {
    Authorization: "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json",
    "Idempotency-Key": "unique-key-123",
  },
  body: JSON.stringify(payment),
});

const data = await response.json();
console.log(data);

package main

import (
    "bytes"
    "encoding/json"
    "fmt"
    "net/http"
)

type PaymentRequest struct {
    Amount      int    `json:"amount"`
    OrderID     string `json:"order_id"`
    CallbackURL string `json:"callback_url"`
    Description string `json:"description"`
    Mobile      string `json:"mobile"`
}

func main() {
    payment := PaymentRequest{
        Amount:      100000,
        OrderID:     "ORDER-12345",
        CallbackURL: "https://merchant.com/callback",
        Description: "خرید محصول آزمایشی",
        Mobile:      "09123456789",
    }

    jsonData, _ := json.Marshal(payment)

    req, _ := http.NewRequest("POST", "https://ipg.irandargah.com/v2/payments", bytes.NewBuffer(jsonData))
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Idempotency-Key", "unique-key-123")

    client := &http.Client{}
    resp, err := client.Do(req)
    if err != nil {
        fmt.Println("Error:", err)
        return
    }
    defer resp.Body.Close()
}

import requests
import json

payment_data = {
    'amount': 100000,
    'order_id': 'ORDER-12345',
    'callback_url': 'https://merchant.com/callback',
    'description': 'خرید محصول آزمایشی',
    'mobile': '09123456789'
}

headers = {
    'Authorization': 'Bearer YOUR_API_TOKEN',
    'Content-Type': 'application/json',
    'Idempotency-Key': 'unique-key-123'
}

response = requests.post(
    'https://ipg.irandargah.com/v2/payments',
    headers=headers,
    json=payment_data
)

result = response.json()
print(result)

using System;
using System.Net.Http;
using System.Text;
using System.Threading.Tasks;
using Newtonsoft.Json;

public class PaymentRequest
{
    [JsonProperty("amount")]
    public int Amount { get; set; }

    [JsonProperty("order_id")]
    public string OrderId { get; set; }

    [JsonProperty("callback_url")]
    public string CallbackUrl { get; set; }

    [JsonProperty("description")]
    public string Description { get; set; }

    [JsonProperty("mobile")]
    public string Mobile { get; set; }
}

public async Task<string> CreatePaymentAsync()
{
    var payment = new PaymentRequest
    {
        Amount = 100000,
        OrderId = "ORDER-12345",
        CallbackUrl = "https://merchant.com/callback",
        Description = "خرید محصول آزمایشی",
        Mobile = "09123456789"
    };

    using var client = new HttpClient();
    client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");
    client.DefaultRequestHeaders.Add("Idempotency-Key", "unique-key-123");

    var json = JsonConvert.SerializeObject(payment);
    var content = new StringContent(json, Encoding.UTF8, "application/json");

    var response = await client.PostAsync("https://ipg.irandargah.com/v2/payments", content);
    return await response.Content.ReadAsStringAsync();
}

{
  "success": true,
  "data": {
    "transaction": {
      "authority": "2025100121424146HC",
      "gateway_url": "https://ipg.irandargah.com/startpay/2025100121424146HC",
      "expires_at": "1404-06-28 10:50:00"
    },
    "meta": {
      "idempotency_key": "unique-key-123",
      "request_id": "65a4c7e8f1234",
      "processing_time_ms": 45
    }
  },
  "message": "تراکنش با موفقیت ایجاد شد",
  "status_code": 200,
  "timestamp": "1404-06-28 10:30:00"
}

{
  "success": false,
  "error": {
    "message": "خطا در اعتبارسنجی ورودی",
    "code": -2,
    "type": "validation_error",
    "details": {
      "validation": {
        "amount": ["حداقل مبلغ رعایت نشده است"],
        "order_id": ["شماره سفارش الزامی است"]
      }
    }
  },
  "status_code": -2,
  "timestamp": "1404-06-28 10:30:00",
  "meta": {
    "request_id": "65a4c7e8f1234"
  }
}

curl "https://ipg.irandargah.com/v2/payments/2025100121424146HC" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

<?php
$authority = '2025100121424146HC';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/payments/{$authority}");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer YOUR_API_TOKEN"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const authority = "2025100121424146HC";

const response = await fetch(
  `https://ipg.irandargah.com/v2/payments/${authority}`,
  {
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
    },
  },
);

const data = await response.json();

authority := "2025100121424146HC"
url := fmt.Sprintf("https://ipg.irandargah.com/v2/payments/%s", authority)

req, _ := http.NewRequest("GET", url, nil)
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

client := &http.Client{}
resp, err := client.Do(req)

authority = '2025100121424146HC'

response = requests.get(
    f'https://ipg.irandargah.com/v2/payments/{authority}',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
)

result = response.json()

string authority = "2025100121424146HC";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");

var response = await client.GetAsync($"https://ipg.irandargah.com/v2/payments/{authority}");
var content = await response.Content.ReadAsStringAsync();

{
  "success": true,
  "data": {
    "transaction": {
      "authority": "2025100121424146HC",
      "ref_id": "2025100121424146HC",
      "amount": 100000,
      "status": "completed",
      "created_at": "1404-06-28 10:30:00",
      "updated_at": "1404-06-28 10:35:00"
    },
    "meta": {
      "request_id": "65a4c7e8f1234",
      "cached": false
    }
  },
  "message": "اطلاعات تراکنش با موفقیت دریافت شد",
  "status_code": 200,
  "timestamp": "1404-06-28 10:35:00"
}

{
  "success": false,
  "error": {
    "message": "تراکنش یافت نشد",
    "code": 404,
    "type": "client_error",
    "details": {
      "transaction": ["تراکنش با این شناسه وجود ندارد"]
    }
  },
  "status_code": 404,
  "timestamp": "1404-06-28 10:35:00",
  "meta": {
    "request_id": "65a4c7e8f1234"
  }
}

curl -X POST "https://ipg.irandargah.com/v2/payments/2025100121424146HC/cancel" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

<?php
$authority = '2025100121424146HC';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/payments/{$authority}/cancel");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer YOUR_API_TOKEN"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const authority = "2025100121424146HC";

const response = await fetch(
  `https://ipg.irandargah.com/v2/payments/${authority}/cancel`,
  {
    method: "POST",
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
    },
  },
);

authority := "2025100121424146HC"
url := fmt.Sprintf("https://ipg.irandargah.com/v2/payments/%s/cancel", authority)

req, _ := http.NewRequest("POST", url, nil)
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

client := &http.Client{}
resp, err := client.Do(req)

authority = '2025100121424146HC'

response = requests.post(
    f'https://ipg.irandargah.com/v2/payments/{authority}/cancel',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
)

string authority = "2025100121424146HC";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");

var response = await client.PostAsync($"https://ipg.irandargah.com/v2/payments/{authority}/cancel", null);

{
  "success": true,
  "data": {
    "transaction": {
      "authority": "2025100121424146HC",
      "ref_id": null,
      "amount": 100000,
      "status": "completed",
      "created_at": "1404-06-28 10:30:00",
      "updated_at": "1404-06-28 10:35:00"
    },
    "meta": {
      "request_id": "65a4c7e8f1234",
      "cached": false
    }
  },
  "message": "پرداخت با موفقیت لغو شد",
  "status_code": 200,
  "timestamp": "1404-06-28 10:35:00"
}

{
  "success": false,
  "error": {
    "message": "تراکنش قابل لغو نیست",
    "code": 400,
    "type": "client_error",
    "details": {
      "transaction": ["وضعیت تراکنش اجازه لغو را نمی‌دهد"]
    }
  },
  "status_code": 400,
  "timestamp": "1404-06-28 10:35:00",
  "meta": {
    "request_id": "65a4c7e8f1234"
  }
}

https://yoursite.com/callback?
  authority=2025100121424146HC&
  status_code=201&
  message=پرداخت+در+انتظار+تایید+است&
  amount=100000&
  order_id=ORDER-12345&
  ref_id=123456789&
  card_pan=603799******1234

<?php
// Laravel - V2 Callback Handler (snake_case)
Route::any('/callback', function (Request $request) {
    // پارامترهای callback امضا نشده‌اند؛ فقط به‌عنوان «ادعا» خوانده می‌شوند
    $authority  = (string) $request->input('authority');
    $statusCode = (int) $request->input('status_code');
    $orderId    = (string) $request->input('order_id');

    // ۱) سفارش را از رکورد خودتان پیدا کنید
    $order = Order::where('order_id', $orderId)->first();

    // ۲) authority ذخیره‌شده‌ی سفارش باید با authority بازگشتی برابر باشد
    if (!$order || !hash_equals((string) $order->authority, $authority)) {
        return view('payment.failed', ['status_code' => -1]);
    }

    // ۳) سفارش قبلاً پرداخت شده است (idempotent)
    if ($order->status === 'paid') {
        return view('payment.success', ['ref_id' => $order->ref_id]);
    }

    // کد 201 و 100 هر دو فقط «ادعای موفقیت» هستند؛ در هر دو حالت تأیید لازم است
    if (in_array($statusCode, [201, 100], true)) {
        // ۴) تأیید با «مبلغ ذخیره‌شده‌ی سفارش» (نه مبلغ callback)
        $response = Http::withToken(env('API_TOKEN'))
            ->post('https://ipg.irandargah.com/v2/verifications', [
                'authority' => $order->authority,
                'amount'    => (int) $order->amount,
            ]);

        $result = $response->json();

        // ۵) مبلغ تأییدشده باید با مبلغ سفارش برابر باشد
        if (
            ($result['success'] ?? false)
            && (int) $result['data']['verification']['amount'] === (int) $order->amount
        ) {
            $ref_id = $result['data']['verification']['ref_id'];

            // ۶) تنها اینجا سفارش پرداخت‌شده علامت می‌خورد
            $order->update([
                'status' => 'paid',
                'ref_id' => $ref_id,
            ]);

            return view('payment.success', ['ref_id' => $ref_id]);
        }
    }

    // پرداخت ناموفق
    return view('payment.failed', ['status_code' => $statusCode]);
});
?>

// Node.js/Express - V2 Callback Handler (snake_case)
const crypto = require("crypto");

// مقایسه‌ی زمان‌ثابت دو رشته
const safeEqual = (a, b) => {
  const x = Buffer.from(String(a));
  const y = Buffer.from(String(b));
  return x.length === y.length && crypto.timingSafeEqual(x, y);
};

app.all("/callback", async (req, res) => {
  // پارامترها از body یا query string دریافت می‌شوند (بسته به action)
  // امضا نشده‌اند؛ فقط به‌عنوان «ادعا» خوانده می‌شوند
  const params = { ...req.query, ...req.body };
  const { authority, order_id } = params;
  const status_code = parseInt(params.status_code);

  // ۱) سفارش را از رکورد خودتان پیدا کنید
  const order = await Order.findOne({ where: { order_id } });

  // ۲) authority ذخیره‌شده باید با authority بازگشتی برابر باشد
  if (!order || !authority || !safeEqual(order.authority, authority)) {
    return res.render("failed", { status_code: -1 });
  }

  // ۳) سفارش قبلاً پرداخت شده است (idempotent)
  if (order.status === "paid") {
    return res.render("success", { ref_id: order.ref_id });
  }

  // کد 201 و 100 هر دو فقط «ادعای موفقیت» هستند؛ در هر دو حالت تأیید لازم است
  if (status_code === 201 || status_code === 100) {
    // ۴) تأیید با «مبلغ ذخیره‌شده‌ی سفارش» (نه مبلغ callback)
    const response = await fetch(
      "https://ipg.irandargah.com/v2/verifications",
      {
        method: "POST",
        headers: {
          Authorization: "Bearer YOUR_API_TOKEN",
          "Content-Type": "application/json",
        },
        body: JSON.stringify({
          authority: order.authority,
          amount: Number(order.amount),
        }),
      },
    );

    const result = await response.json();

    // ۵) مبلغ تأییدشده باید با مبلغ سفارش برابر باشد
    if (
      result.success &&
      Number(result.data.verification.amount) === Number(order.amount)
    ) {
      // ۶) تنها اینجا سفارش پرداخت‌شده علامت می‌خورد
      await order.update({
        status: "paid",
        ref_id: result.data.verification.ref_id,
      });

      return res.render("success", {
        ref_id: result.data.verification.ref_id,
      });
    }
  }

  res.render("failed", { status_code });
});

# Python/Django - V2 Callback Handler (snake_case)
import hmac
from django.shortcuts import render
import requests

def payment_callback(request):
    # پارامترهای callback (GET یا POST بسته به action)
    # امضا نشده‌اند؛ فقط به‌عنوان «ادعا» خوانده می‌شوند
    params = request.POST if request.method == 'POST' else request.GET
    authority = params.get('authority') or ''
    order_id  = params.get('order_id')
    try:
        status_code = int(params.get('status_code', -1))
    except ValueError:
        status_code = -1

    # ۱) سفارش را از رکورد خودتان پیدا کنید
    order = Order.objects.filter(order_id=order_id).first()

    # ۲) authority ذخیره‌شده باید با authority بازگشتی برابر باشد
    if order is None or not hmac.compare_digest(
        str(order.authority).encode(), authority.encode()
    ):
        return render(request, 'payment/failed.html', {'status_code': -1})

    # ۳) سفارش قبلاً پرداخت شده است (idempotent)
    if order.status == 'paid':
        return render(request, 'payment/success.html', {'ref_id': order.ref_id})

    # کد 201 و 100 هر دو فقط «ادعای موفقیت» هستند؛ در هر دو حالت تأیید لازم است
    if status_code in (201, 100):
        # ۴) تأیید با «مبلغ ذخیره‌شده‌ی سفارش» (نه مبلغ callback)
        response = requests.post(
            'https://ipg.irandargah.com/v2/verifications',
            headers={'Authorization': 'Bearer YOUR_API_TOKEN'},
            json={
                'authority': order.authority,
                'amount':    int(order.amount),
            },
            timeout=15,
        )

        result = response.json()

        # ۵) مبلغ تأییدشده باید با مبلغ سفارش برابر باشد
        if (
            result.get('success')
            and int(result['data']['verification']['amount']) == int(order.amount)
        ):
            ref_id = result['data']['verification']['ref_id']

            # ۶) تنها اینجا سفارش پرداخت‌شده علامت می‌خورد
            order.status = 'paid'
            order.ref_id = ref_id
            order.save(update_fields=['status', 'ref_id'])

            return render(request, 'payment/success.html', {'ref_id': ref_id})

    return render(request, 'payment/failed.html', {'status_code': status_code})

curl -X POST "https://ipg.irandargah.com/v2/verifications" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -H "Idempotency-Key: verification-key-123" \
  -d '{
    "authority": "2025100121424146HC",
    "amount": 100000
  }'

<?php
$data = [
    'authority' => '2025100121424146HC',
    'amount' => 100000
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/verifications");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer YOUR_API_TOKEN",
    "Content-Type: application/json",
    "Idempotency-Key: verification-key-123"
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);

$result = json_decode($response, true);
?>

const verification = {
  authority: "2025100121424146HC",
  amount: 100000,
};

const response = await fetch("https://ipg.irandargah.com/v2/verifications", {
  method: "POST",
  headers: {
    Authorization: "Bearer YOUR_API_TOKEN",
    "Content-Type": "application/json",
    "Idempotency-Key": "verification-key-123",
  },
  body: JSON.stringify(verification),
});

const data = await response.json();

type VerificationRequest struct {
    Authority string `json:"authority"`
    Amount    int    `json:"amount"`
}

func verifyPayment() {
    verification := VerificationRequest{
        Authority: "2025100121424146HC",
        Amount:    100000,
    }

    jsonData, _ := json.Marshal(verification)

    req, _ := http.NewRequest("POST", "https://ipg.irandargah.com/v2/verifications", bytes.NewBuffer(jsonData))
    req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
    req.Header.Set("Content-Type", "application/json")
    req.Header.Set("Idempotency-Key", "verification-key-123")

    client := &http.Client{}
    resp, err := client.Do(req)
}

verification_data = {
    'authority': '2025100121424146HC',
    'amount': 100000
}

headers = {
    'Authorization': 'Bearer YOUR_API_TOKEN',
    'Content-Type': 'application/json',
    'Idempotency-Key': 'verification-key-123'
}

response = requests.post(
    'https://ipg.irandargah.com/v2/verifications',
    headers=headers,
    json=verification_data
)

result = response.json()

public class VerificationRequest
{
    [JsonProperty("authority")]
    public string Authority { get; set; }

    [JsonProperty("amount")]
    public int Amount { get; set; }
}

var verification = new VerificationRequest
{
    Authority = "2025100121424146HC",
    Amount = 100000
};

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");
client.DefaultRequestHeaders.Add("Idempotency-Key", "verification-key-123");

var json = JsonConvert.SerializeObject(verification);
var content = new StringContent(json, Encoding.UTF8, "application/json");

var response = await client.PostAsync("https://ipg.irandargah.com/v2/verifications", content);

{
  "success": true,
  "data": {
    "verification": {
      "ref_id": "123456789",
      "authority": "2025100121424146HC",
      "amount": 100000,
      "verified_at": "1404-06-28 10:35:00"
    },
    "meta": {
      "request_id": "req_verify_001",
      "processing_time_ms": 85
    }
  },
  "message": "تراکنش با موفقیت تأیید شد",
  "status_code": 200,
  "timestamp": "1404-06-28 10:35:00"
}

{
  "success": false,
  "error": {
    "message": "شناسه یکتا، شماره سفارش یا مبلغ اشتباه است",
    "code": -19,
    "type": "business_logic_error"
  },
  "status_code": -19,
  "timestamp": "1404-06-28 10:35:00",
  "meta": {
    "request_id": "req_verify_001"
  }
}

curl "https://ipg.irandargah.com/v2/verifications/2025100121424146HC" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

<?php
$authority = '2025100121424146HC';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/verifications/{$authority}");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer YOUR_API_TOKEN"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const authority = "2025100121424146HC";

const response = await fetch(
  `https://ipg.irandargah.com/v2/verifications/${authority}`,
  {
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
    },
  }
);

const data = await response.json();

authority := "2025100121424146HC"
url := fmt.Sprintf("https://ipg.irandargah.com/v2/verifications/%s", authority)

req, _ := http.NewRequest("GET", url, nil)
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

client := &http.Client{}
resp, err := client.Do(req)

authority = '2025100121424146HC'

response = requests.get(
    f'https://ipg.irandargah.com/v2/verifications/{authority}',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
)

result = response.json()

string authority = "2025100121424146HC";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");

var response = await client.GetAsync($"https://ipg.irandargah.com/v2/verifications/{authority}");
var content = await response.Content.ReadAsStringAsync();

{
  "success": true,
  "data": {
    "verification": {
      "ref_id": "123456789",
      "authority": "2025100121424146HC",
      "amount": 100000,
      "verified_at": "1404-06-28 10:35:00"
    },
    "meta": {
      "request_id": "req_status_001"
    }
  },
  "message": "اطلاعات تراکنش با موفقیت دریافت شد",
  "status_code": 200,
  "timestamp": "1404-06-28 10:40:00"
}

{
  "success": false,
  "error": {
    "message": "تراکنش یافت نشد",
    "code": 404,
    "type": "client_error",
    "details": {
      "transaction": ["تراکنش با این شناسه وجود ندارد"]
    }
  },
  "status_code": 404,
  "timestamp": "1404-06-28 10:40:00",
  "meta": {
    "request_id": "req_status_001"
  }
}

curl -X POST "https://ipg.irandargah.com/v2/verifications/2025100121424146HC/retry" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

<?php
$authority = '2025100121424146HC';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/verifications/{$authority}/retry");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer YOUR_API_TOKEN"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const authority = "2025100121424146HC";

const response = await fetch(
  `https://ipg.irandargah.com/v2/verifications/${authority}/retry`,
  {
    method: "POST",
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
    },
  }
);

authority := "2025100121424146HC"
url := fmt.Sprintf("https://ipg.irandargah.com/v2/verifications/%s/retry", authority)

req, _ := http.NewRequest("POST", url, nil)
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

client := &http.Client{}
resp, err := client.Do(req)

authority = '2025100121424146HC'

response = requests.post(
    f'https://ipg.irandargah.com/v2/verifications/{authority}/retry',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
)

string authority = "2025100121424146HC";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");

var response = await client.PostAsync($"https://ipg.irandargah.com/v2/verifications/{authority}/retry", null);

{
  "success": true,
  "data": {
    "verification": {
      "ref_id": "123456789",
      "authority": "2025100121424146HC",
      "amount": 100000,
      "verified_at": "1404-06-28 10:45:00"
    },
    "meta": {
      "request_id": "req_retry_001",
      "processing_time_ms": 120
    }
  },
  "message": "تأیید مجدد با موفقیت انجام شد",
  "status_code": 200,
  "timestamp": "1404-06-28 10:45:00"
}

{
  "success": false,
  "error": {
    "message": "تراکنش یافت نشد",
    "code": 404,
    "type": "client_error",
    "details": {
      "transaction": ["تراکنش با این شناسه وجود ندارد"]
    }
  },
  "status_code": 404,
  "timestamp": "1404-06-28 10:45:00",
  "meta": {
    "request_id": "req_retry_001"
  }
}

curl "https://ipg.irandargah.com/v2/transactions?page=1&per_page=10&status=completed&from_date=1404-06-01&to_date=1404-06-31" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

<?php
$query = http_build_query([
    'page'      => 1,
    'per_page'  => 10,
    'status'    => 'completed',
    'from_date' => '1404-06-01',
    'to_date'   => '1404-06-31',
]);

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/transactions?{$query}");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer YOUR_API_TOKEN"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const params = new URLSearchParams({
  page:      1,
  per_page:  10,
  status:    "completed",
  from_date: "1404-06-01",
  to_date:   "1404-06-31",
});

const response = await fetch(
  `https://ipg.irandargah.com/v2/transactions?${params}`,
  {
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
    },
  }
);

params := url.Values{}
params.Add("page", "1")
params.Add("per_page", "10")
params.Add("status", "completed")
params.Add("from_date", "1404-06-01")
params.Add("to_date", "1404-06-31")

url := fmt.Sprintf("https://ipg.irandargah.com/v2/transactions?%s", params.Encode())

req, _ := http.NewRequest("GET", url, nil)
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

params = {
    'page':      1,
    'per_page':  10,
    'status':    'completed',
    'from_date': '1404-06-01',
    'to_date':   '1404-06-31',
}

response = requests.get(
    'https://ipg.irandargah.com/v2/transactions',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'},
    params=params
)

var query = "?page=1&per_page=10&status=completed&from_date=1404-06-01&to_date=1404-06-31";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");

var response = await client.GetAsync($"https://ipg.irandargah.com/v2/transactions{query}");

{
  "success": true,
  "data": {
    "transactions": [
      {
        "authority": "2025100121424146HC",
        "amount": 100000,
        "status": "completed",
        "order_id": "ORDER-12345",
        "ref_code": "2025100121424146HC",
        "created_at": "1404-06-28 10:30:00",
        "verified_at": "1404-06-28 10:45:00"
      }
    ],
    "pagination": {
      "current_page": 1,
      "per_page": 10,
      "total": 1,
      "last_page": 1
    }
  },
  "timestamp": "1404-06-28 10:45:00"
}

{
  "success": false,
  "error": {
    "message": "اطلاعات احراز هویت نامعتبر است",
    "code": -51,
    "type": "authentication_error",
    "details": {
      "authentication": ["اطلاعات احراز هویت نامعتبر است"]
    }
  },
  "status_code": -51,
  "timestamp": "1404-06-28 10:45:00",
  "meta": {
    "request_id": "65a4c7e8f1234"
  }
}

curl "https://ipg.irandargah.com/v2/transactions/2025100121424146HC" \
  -H "Authorization: Bearer YOUR_API_TOKEN"

<?php
$authority = '2025100121424146HC';

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/transactions/{$authority}");
curl_setopt($ch, CURLOPT_HTTPHEADER, ["Authorization: Bearer YOUR_API_TOKEN"]);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const authority = "2025100121424146HC";

const response = await fetch(
  `https://ipg.irandargah.com/v2/transactions/${authority}`,
  {
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
    },
  }
);

authority := "2025100121424146HC"
url := fmt.Sprintf("https://ipg.irandargah.com/v2/transactions/%s", authority)

req, _ := http.NewRequest("GET", url, nil)
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")

authority = '2025100121424146HC'

response = requests.get(
    f'https://ipg.irandargah.com/v2/transactions/{authority}',
    headers={'Authorization': 'Bearer YOUR_API_TOKEN'}
)

string authority = "2025100121424146HC";

using var client = new HttpClient();
client.DefaultRequestHeaders.Add("Authorization", "Bearer YOUR_API_TOKEN");

var response = await client.GetAsync($"https://ipg.irandargah.com/v2/transactions/{authority}");

{
  "success": true,
  "data": {
    "transaction": {
      "authority": "2025100121424146HC",
      "order_id": "ORDER-12345",
      "amount": 100000,
      "status": "completed",
      "workflow_state": "COMPLETED",
      "description": "خرید محصول آزمایشی",
      "ref_code": "2025100121424146HC",
      "callback_url": "https://merchant.com/callback",
      "created_at": "1404-06-28 10:30:00",
      "updated_at": "1404-06-28 10:35:00",
      "expires_at": "1404-06-28 10:50:00",
      "is_expired": false,
      "can_be_verified": false,
      "verification_status": 200
    }
  },
  "timestamp": "1404-06-28 11:00:00"
}

{
  "success": false,
  "error": {
    "message": "تراکنش یافت نشد",
    "code": 404,
    "type": "client_error",
    "details": {
      "transaction": ["تراکنش با این شناسه وجود ندارد"]
    }
  },
  "status_code": 404,
  "timestamp": "1404-06-28 11:00:00",
  "meta": {
    "request_id": "65a4c7e8f1234"
  }
}

curl -X POST "https://ipg.irandargah.com/v2/webhooks/subscribe" \
  -H "Authorization: Bearer YOUR_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "url": "https://merchant.com/webhook",
    "events": ["payment.completed", "payment.failed"],
    "secret": "your_optional_secret_min_8_chars",
    "description": "وب‌هوک اصلی فروشگاه"
  }'

<?php
$data = [
    'url'         => 'https://merchant.com/webhook',
    'events'      => ['payment.completed', 'payment.failed'],
    'secret'      => 'your_optional_secret_min_8_chars', // اختیاری
    'description' => 'وب‌هوک اصلی فروشگاه',              // اختیاری
];

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, "https://ipg.irandargah.com/v2/webhooks/subscribe");
curl_setopt($ch, CURLOPT_POST, true);
curl_setopt($ch, CURLOPT_HTTPHEADER, [
    "Authorization: Bearer YOUR_API_TOKEN",
    "Content-Type: application/json",
]);
curl_setopt($ch, CURLOPT_POSTFIELDS, json_encode($data, JSON_UNESCAPED_UNICODE));
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);

$response = curl_exec($ch);
curl_close($ch);
?>

const webhook = {
  url: "https://merchant.com/webhook",
  events: ["payment.completed", "payment.failed"],
  secret: "your_optional_secret_min_8_chars", // اختیاری
  description: "وب‌هوک اصلی فروشگاه", // اختیاری
};

const response = await fetch(
  "https://ipg.irandargah.com/v2/webhooks/subscribe",
  {
    method: "POST",
    headers: {
      Authorization: "Bearer YOUR_API_TOKEN",
      "Content-Type": "application/json",
    },
    body: JSON.stringify(webhook),
  },
);

type WebhookSubscription struct {
    URL         string   `json:"url"`
    Events      []string `json:"events"`
    Secret      string   `json:"secret,omitempty"`
    Description string   `json:"description,omitempty"`
}

webhook := WebhookSubscription{
    URL:         "https://merchant.com/webhook",
    Events:      []string{"payment.completed", "payment.failed"},
    Secret:      "your_optional_secret_min_8_chars",
    Description: "وب‌هوک اصلی فروشگاه",
}

jsonData, _ := json.Marshal(webhook)

req, _ := http.NewRequest("POST", "https://ipg.irandargah.com/v2/webhooks/subscribe", bytes.NewBuffer(jsonData))
req.Header.Set("Authorization", "Bearer YOUR_API_TOKEN")
req.Header.Set("Content-Type", "application/json")

webhook_data = {
    'url':         'https://merchant.com/webhook',
    'events':      ['payment.completed', 'payment.failed'],
    'secret':      'your_optional_secret_min_8_chars',  # اختیاری
    'description': 'وب‌هوک اصلی فروشگاه',                # اختیاری
}

response = requests.post(
    'https://ipg.irandargah.com/v2/webhooks/subscribe',
    headers={
        'Authorization': 'Bearer YOUR_API_TOKEN',
        'Content-Type':  'application/json',
    },
    json=webhook_data
)